Anduril NixOS Security Technical Implementation Guide

The Anduril NixOS Security Technical Implementation Guide (V1 R3) has 103 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

103STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R3

CurrentPublished Wed Sep 30 2026

NixOS systemd-journald directory must have a mode of 2755 or less permissive.

Anduril NixOS Security Technical Implementation Guide

Assessment Title

Rule Text

NixOS systemd-journald directory must have a mode of 2755 or less permissive.

Description

Discussion Text

Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.

Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit NixOS system activity.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-268117

Rule

SV-268117r1131034_rule

Severity

medium

Rule Version

ANIX-00-000590

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify NixOS protects log information from unauthorized read access by implementing a mode of 2755 or less on the creation of log directories with the following command: 

$ sudo find /var/log/journal -type d -perm -2755 -not -perm 2755 -printf "%p %m\n"

If any directories have a permission of greater than 2755, this is a finding.

Implementation Procedure

Fix Text

The systemd-journald directories are by design set to 2755 mode.

If any directories are found with incorrect perms, correct them with the following command:

$ sudo find /var/log/journal -type d -exec chmod 2755 {} \;

STIG check 40 of 103 in the Anduril NixOS STIG checklist

← Previous · V-268116NixOS journald directory and logs must be group-owned by systemd-journald to prevent unauthorized read access.Next · V-268118 →NixOS systemd-journald logs must have a mode of 0640 or less permissive.